HAX CMS CVE-2026-46394

Attacker must hold a valid low-privilege authenticated session on the HAX CMS PHP backend (CVSS PR:L) and must be able to reach an HTTP endpoint that invokes one of the 16 unsafe functions in Git.php (any function except commit()). The AT:P attack requirement reflects that the target HAX CMS instance must have its Git integration features enabled and reachable - installations that do not expose Git operations are not exploitable. Exploitation does not require user interaction (UI:N) and works over the network (AV:N), but AC:H indicates non-trivial crafting of the injected parameter is needed to bypass partial validation. The Node.js backend deployment is out of scope per the advisory.

CVSS 4.0 scores this 7.7 (High) with vector AV:N/AC:H/AT:P/PR:L/UI:N and VC:H/VI:H/VA:H - network-reachable, low-privilege authenticated, but with high attack complexity and a required attack prerequisite (AT:P), meaning exploitation is non-trivial in default deployments. EPSS and KEV data were not provided in the intelligence feed, so probability of mass exploitation cannot be quantified, and there is no public exploit identified at time of analysis. The advisory explicitly notes that chaining with a separate configuration-manipulation vulnerability escalates this to full RCE and system compromise, so defenders should treat the score as a floor rather than a ceiling - particularly in multi-tenant or internet-exposed HAX CMS installations. Risk is real but bounded by the PR:L requirement: an authenticated foothold is needed before this sink is reachable.

An attacker registers or compromises a low-privilege HAX CMS account, then submits a Git operation (e.g., setting a remote URL, branch name, or path) containing shell metacharacters such as ; or $(). The malicious value flows unescaped into one of the 16 vulnerable Git.php functions and is executed by proc_open() as the web server user, yielding code execution; chaining with the referenced configuration-manipulation flaw enables full RCE and host compromise. No public exploit code has been identified, but the advisory provides enough detail for a skilled attacker to reproduce.